pe: Recognize RVAs below mapped sections
pe: Recognize RVAs below mapped sections

Closes #379, #395

tanium/yara,cblichmann/yara,VirusTotal/yara,msuvajac/yara,tanium/yara,jpypi/yara,pombredanne/yara,cblichmann/yara,mgoffin/yara,VirusTotal/yara,VirusTotal/yara,hillu/yara,MeteorAdminz/yara,plusvic/yara,kallanreed/yara,bmagistro/yara,rednaga/yara,VirusTotal/yara,MeteorAdminz/yara,plusvic/yara,hillu/yara,rednaga/yara,bmagistro/yara,VirusTotal/yara,cblichmann/yara,kallanreed/yara,hillu/yara,cblichmann/yara,pombredanne/yara,hillu/yara,pombredanne/yara,plusvic/yara,wxsBSD/yara,MeteorAdminz/yara,wxsBSD/yara,wxsBSD/yara,jpypi/yara,plusvic/yara,wxsBSD/yara,msuvajac/yara,hillu/yara,bmagistro/yara,wxsBSD/yara,jpypi/yara,rednaga/yara,cblichmann/yara,mgoffin/yara,msuvajac/yara,kallanreed/yara,tanium/yara,pombredanne/yara,mgoffin/yara,mgoffin/yara,plusvic/yara,pombredanne/yara